CVE-2026-61515: Puwell IP Camera RCE Vulnerability

CVE-2026-61515 Overview

CVE-2026-61515 is an unauthenticated command injection vulnerability affecting Puwell IP Camera firmware versions 2.x through 4.x. The flaw resides in the DebugShell interface exposed on TCP port 34567. Remote attackers can send a crafted JSON payload to the binary protocol service, bypassing authentication entirely. The service lacks input sanitization and passes attacker-controlled strings directly to the underlying operating system. Successful exploitation yields root-level code execution and complete device compromise. The vulnerability is classified under CWE-912: Hidden Functionality.

Critical Impact
Unauthenticated remote attackers reachable on TCP port 34567 can execute arbitrary OS commands as root, fully compromising affected Puwell IP cameras.

Affected Products

Puwell IP Camera firmware version 2.x
Puwell IP Camera firmware version 3.x
Puwell IP Camera firmware version 4.x

Discovery Timeline

2026-08-04 - CVE-2026-61515 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-61515

Vulnerability Analysis

The Puwell IP Camera exposes a proprietary binary protocol service on TCP port 34567. Within this service, a DebugShell interface accepts JSON-formatted requests without performing authentication. When a client submits a payload containing shell command fields, the service forwards those values to a system shell without validation, escaping, or allow-listing. This design constitutes hidden debug functionality shipped in production firmware, mapped to [CWE-912]. Because the process runs with root privileges, any injected command inherits full control over the device, including firmware modification, credential extraction, and pivoting into the local network. The current EPSS probability is 1.579%, placing the flaw in the 73rd percentile of published CVEs.

Root Cause

The root cause is the presence of an undocumented DebugShell handler within the port 34567 binary service. This handler was intended for factory diagnostics but remains reachable in shipped firmware. It performs no authentication, applies no argument filtering, and invokes the OS shell directly with attacker-supplied strings.

Attack Vector

Exploitation requires only network reachability to TCP port 34567 on a vulnerable camera. An attacker constructs a JSON message conforming to the vendor's binary protocol header, sets a command field to an arbitrary shell payload, and transmits it to the device. The DebugShell handler parses the payload, executes the command as root, and may return output over the same connection. No credentials, user interaction, or prior foothold are required. For payload structure and reproduction details, refer to the VulnCheck Advisory on Puwell and the Damiri CVE Details.

No verified proof-of-concept code is published; the vulnerability mechanism is described in prose above based on vendor and advisory references.

Detection Methods for CVE-2026-61515

Indicators of Compromise

Unexpected inbound connections to TCP port 34567 from untrusted networks or WAN addresses.
New or unfamiliar processes spawned by the camera's main service binary, particularly shells such as /bin/sh or busybox with unusual arguments.
Outbound connections from the camera to attacker-controlled hosts, including reverse shells or file transfers.
Modifications to firmware files, /etc/passwd, or persistence locations such as init scripts on the device.

Detection Strategies

Inspect network traffic for JSON payloads directed at TCP port 34567 that include shell metacharacters (;, |, `, $()) or command names.
Deploy signatures for the Puwell binary protocol header followed by DebugShell string references in packet payloads.
Correlate camera-originated DNS lookups and egress traffic against baseline behavior; IP cameras rarely initiate outbound sessions.

Monitoring Recommendations

Log and alert on all traffic to TCP port 34567 across the network perimeter and internal segments hosting IoT devices.
Enable NetFlow or IPFIX collection on VLANs containing IP cameras and review for anomalous session duration or byte counts.
Monitor DHCP and ARP tables for Puwell OUI devices to maintain an accurate inventory of exposed cameras.

How to Mitigate CVE-2026-61515

Immediate Actions Required

Block inbound access to TCP port 34567 on all perimeter firewalls and restrict lateral access using network segmentation.
Place Puwell IP cameras on an isolated VLAN with no direct internet exposure and no routing to sensitive enterprise assets.
Inventory all Puwell devices and identify firmware versions in the 2.x–4.x range for prioritized remediation.
Disable Universal Plug and Play (UPnP) on gateway routers to prevent automatic port 34567 exposure to the internet.

Patch Information

No vendor patch has been published in the referenced advisories at the time of writing. Consult the Puwell Catalog Overview and the VulnCheck Advisory on Puwell for the latest firmware guidance. Where a fixed firmware release is unavailable, treat affected devices as unpatchable and apply compensating network controls.

Workarounds

Enforce ACLs on managed switches and firewalls to drop any packet destined for TCP port 34567 originating outside a small administrative allow-list.
Terminate camera video streams through a hardened NVR or reverse proxy so that the camera itself is never reachable from user networks.
Retire and replace affected devices when firmware updates cannot be obtained, particularly in high-value environments.

bash

# Configuration example: block reachability to the DebugShell port
# iptables rule on an upstream Linux gateway
iptables -A FORWARD -p tcp --dport 34567 -j DROP
iptables -A INPUT   -p tcp --dport 34567 -j DROP

# Cisco IOS ACL example
ip access-list extended BLOCK_PUWELL_DEBUGSHELL
 deny   tcp any any eq 34567 log
 permit ip  any any